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REMARKS/ARGUMENTS 

This Amendment is in response to the Office Action mailed on January 27, 2005 (" Office 
Action "). Claims 1-34 were rejected. Review and reconsideration are requested in view of the 
following remarks. Additionally, Applicants request amendment of claims 1 and 25 and addition 
of new claims 35 and 36. 

Interview Summary 

The Applicants* representative thanks the Examiner for the time extended for a 
telephonic interview on June 8, 2005. The Applicants' representative explained that one of 
ordinary skill in the art would not be motivated to modify Orchier in view of Rowland to be able 
to detect intrusions as they are occurring or soon thereafter as asserted in the Office Action. 
Rather* Orchier teaches away from such a modification in view of Rowland. Orchier teaches a 
batch approach with actions at scheduled intervals. Rather, Applicants* representative explained 
that Orchier emphasizes a batch approach, and such an approach is contrary to a goal of being 
able to detect intrusions as they are occurring or soon thereafter. Thus, one skilled in the art 
would not be motivated to modify Orchier in view of Rowland in order to detect intrusions as 
they axe occurring or soon thereafter, since such a goal is contrary to the teaching of Orchier. 

Claims 2 and 3 regarding a graphical user interface were also discussed. The Examiner 
indicated that combination of such elements with claim 1 may be patentable. 

Amendment of Claim?? 1 and 25 

Claims 1 and 25 have been amended. It is believed that such amendment does not 
substantively change, the meaning of such claims but helps illustrate the invention. 

Rejection of Claims 1-10. 12-15. 17-22, 25-31, 33 and 34 under 35 U.S-C. S 103 

Claims 1-10, 12-15, 17-22, 25-31, 33 and 34 were rejected under 35 U.S.C § 103(a) as 
being unpatentable over US Patent No. 6,070,244 (Orchier) and further in view of US Patent No. 
6,405,318 (Rowland). Applicants respectfully traverse the rejection. 

The Office Action recognizes that Orchier fails to teach transmitting an event object in 
real time, relative to the receipt of the log data, as an intrusion alarm* However, the Office 
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Action looks to the reference Rowland, arguing that Rowland teaches transmitting an event 
object in real time, and arguing that it would have been obvious to modify Orchier in view of 
Rowland to be able to detect intrusions as they are occurring or soon thereafter* Applicants 
respectfully disagree that Orchier and Rowland render the invention of claim 1 obvious. 

It is believed that one of ordinary skill in the art would not be motivated to modify 
Orchier in view of Rowland to be able to detect intrusions as they are occurring or soon 
thereafter as asserted in the Office Action. Rather, Orchier teaches away from such a 
modification in view of Rowland, See MPEP 2141 .02: 

A prior art reference must be considered in its entirety, i,e*, as a whole, including portions 
that would lead awav from the claimed invention, 

(emphasis added). Orchier teaches a batch approach with actions at scheduled intervals. See for 
example, Figures 4b» 4c, and 4e of Orchier, which refer to actions taking place at a designated 
time of day. Thus, Orchier is teaching a batch approach, rather than a real time approach. See 
also Orchier, column 11, lines 4-6, which refer to steps including scheduling the starting of the 
program at a designated time of day. Thus, Orchier emphasizes a batch approach, and such an 
approach is contrary to a goal of being able to detect intrusions as they are occurring or soon 
thereafter. Thus, one skilled in the art would not be motivated to modify Orchier in view of 
Rowland in order to detect intrusions as they are occurring or soon thereafter, since such a goal is 
contrary to the teaching of Orchier. See MPEP 2143.01: 

If the proposed modification or combination of the prior art would change the principle of 
operation of the prior art invention being modified, then the teachings of the references 
are not sufficient to render the claims prima facie obvious. 

(emphasis added). Therefore, Orchier and Rowland fail to render the invention of claim 1 
obvious and it is believed that the rejection of claim 1 should be removed Accordingly, removal 
of the rejection of claim 1 is respectfully requested. 

Additionally, the cited portion of Rowland does not teach "broadcasting an event object 
as an intrusion alarm ." Rather, Rowland teaches various actions that may be performed. See 
Rowland column 7, line 55 through column 8, line 7. Thus, Rowland provides no teaching of 
broadcasting an event object, as an intrusion alarm . Therefore, even in combination, the 
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. references Orchier and Rowland fail to teach all the elements of the invention of claim 1 and 
therefore fail to render claim 1 obvious. For this additional reason, it is believed that the 
rejection of claim 1 should be removed. 

As to claim 25, the Office Action also recognizes that Orchier fails to teach broadcasting 
an event object in real time, relative to receipt of log data, as an intrusion alarm. However, the 
Office Action looks to the reference Rowland, arguing that Rowland teaches transmitting an 
event object in real time, and arguing that it would have been obvious to modify Orchier in view 
of Rowland to be able to detect intrusions as they are occurring or soon thereafter. For the 
reasons stated above, it is believed that one of ordinary skill in the art would not be motivated to 
modify Orchier in view of Rowland to be able to detect intrusions as they are occurring or soon 
thereafter, Thus, it is believed that Orchier and Rowland fail to render the invention of claim 25 
obvious. Removal of the rejection is therefore respectfully requested. 

Additionally, as discussed above, the cited portion of Rowland does not teach 
"broadcasting an event object as an intrusion alarm /' Rather, Rowland appears to teach various 
actions that may be performed. Therefore, as stated above, even in combination, the references 
Orchier and Rowland fail to teach all the elements of the invention of claim 25 and therefore fail 
to render claim 25 obvious. For this additional reason, it is believed that the rejection of claim 
25 should be removed. 

Further, claim 25 states that the network service devices comprise a device from a group 
comprising a firewall, VPN (virtual private network) server or router, and e-mail server. The 
Office Action recites such items (bottom of page 3 of Office Action) but points to no particular 
teaching of such items in Orchier or other references. See MPEP 2143.03: 

To establish prima facie obviousness of a claimed invention, all the claim limitations 
must be taught or suggested by the prior art. 

(emphasis added). See also 37 C.F.R. 1.104(c)(2), stating, in part, "When a reference is complex 
or shows or describes inventions other than that claimed by the applicant, the particular part 
relied on must be designated as nearly as practicable/' (emphasis added). It is believed that the 
Office Action has not shown a teaching or suggestion of such limitations in Orchier. Thus, it is 
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believed for this additional reason a prima facie case of obviousness is not established with 
respect to claim 25. 

Claims 2-24 depend directly or indirectly from claim 1, and claims 26-34 depend directly 
or indirectly from claim 25. Such claims are believed patentable for at least the reasons as to 
their parent claims. Further, these claims are believed independently patentable, and it is 
believed that the application of Orchier and Rowland to such claims is incorrect. Removal of the 
rejection of such claims is therefore respectfully requested. Applicants have also presented 
reasons for patentability of various ones of such claims in Applicants' previous response, and 
Applicants incorporate such reasons herein by reference. 

Re jection of Claims 11, 16. 23-24 and 32 Refections under 35 U.S.C. $ 103 

Claim 1 1 was rejected under 35 U.S.C. § 103 as being unpatentable over Orchier and 
Rowland in view of US Patent No. 5,958,012 (Battat). Applicants respectfully traverse the 
rejection. Such rejection assumes that one of ordinary skill in the art would be motivated to 
modify Orchier in view of Rowland. However, it is believed that one of ordinary skill in the art 
would not be motivated to modify Orchier in view of Rowland to be able to detect intrusions as 
they are occurring or soon thereafter. Accordingly, the rejection of claim 1 1 under 35 USC 
§ 103 is believed incorrect, and removal of the rejection of claim 1 1 is respectfully requested. 

Claim 16 was rejected under 35 U.S.C. § 103(a) as being unpatentable over Orchier and 
Rowland in view of US Patent No. 6,088,804 (Hill). Applicants respectfully traverse the 
rejection. Such rejection assumes that one of ordinary skill in the art would be motivated to 
mollify Orchier in view of Rowland. However, it is believed that one of ordinary skill in the art 
would not be motivated to modify Orchier in view of Rowland to be able to detect intrusions as 
they are occurring or soon thereafter. Accordingly, the rejection of claim 16 under 35 USC 
§ 103(a) is believed incorrect, and removal of the rejection of claim 16 is respectfully requested. 

Claims 23, 24, and 32 were rejected under 35 U.S.C. § 103(a) as being unpatentable over 
Orchier and Rowland. Such rejection assumes that one of ordinary skill in the art would be 
motivated to modify Orchier in view of Rowland. However, it is believed that one of ordinary 
skill in the art would not be motivated to modify Orchier in view of Rowland to be able to detect 
intrusions as they are occurring or soon thereafter. Accordingly, the rejection of claims 23, 24, 
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and 32 under 35 USC § 103(a) is believed incorrect, and removal of the rejection of claims 23, 
24, and 32 is respectfully requested. 

New Claims 35 and 36 

New claims 35 and 36 have been added in order to more fully claim Applicants' 
invention. Applicants respectfully request addition of such claims to the application. 

Support for such new claims is found, inter alia, in claims 1 and 25 as well as in the 
specification, page 16. No new matter is added. 

It is noted for example that claim 35 includes, in addition to other elements, an event 

aggregator, the event aggregator being able to filter the event objects based on event type and 

security. Claim 36 includes, in addition to the other elements: 

parsing the log data information to create corresponding event objects; 
filtering the event objects based on event type and severity; and 
evaluating the event objects according to at least one predetermined 
threshold condition; 

It is believed that new claims 35 and 36 are patentable over the cited references. Review 
and approval of such claims are respectfully requested. 
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CONCLUSION 

Applicants submit that the instant application is in condition for allowance. Should the 
Examiner have any questions, the Examiner is. requested to contact the undersigned attorney. 

The Commissioner is authorized to charge any additional fees which may be required, 
including petition fees and extension of time fees, to Deposit Account No. 23-2415 (Docket No. 
26836.701.201). . 



Respectfully submitted, 

WILSON SONSINI GOODRICH & ROSATI 



Date: June 10. 2005 




650 Page Mill Road 
Palo Alto, CA 94304 
(650) 493-9300 
Customer No. 021971 
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